Yesterday I found an interesting JavaSvript script delivered through a regular phishing campaign (SHA256:70c0b9d1c88f082bad6ae01fef653da6266d0693b24e08dcb04156a629dd6f81) and has a VT score of 17/61[1]

The script obfuscation is simple but effective: the malicious code is decoded and passed to an eval() function to be executed:

function wrwrwrwererw(iyuiyiyuiyiyyui,jljkljkllljkllklklkj) {
    var wqwqsdasda;
    var popopoppop="";
    var xxxxxxxzzzzzzzzzz=(iyuiyiyuiyiyyui+"").split("");
    var rwerwwrwrww0=(jljkljkllljkllklklkj+"").split("");
    var ererrer545=rwerwwrwrww0.length;
    for (var aaaaa888=0;aaaaa888<xxxxxxxzzzzzzzzzz.length;aaaaa888++){
        wqwqsdasda=xxxxxxxzzzzzzzzzz[aaaaa888].charCodeAt(0);
        popopoppop+=String.fromCharCode(+wqwqsdasda-+1000-(ererrer545+10));
    }
    return popopoppop;
}

WScript.Sleep(5000);
eval(wrwrwrwererw(" <malicious_data> ", "123");

The payload is a string of Unicode characters converted one by one through the wrwrwrwererw() function.

The first character is the 'cyrillic capital letter ef' which has the decimal code 1060. The decoding is performed by the following line:

popopoppop+=String.fromCharCode(1060-1000-(3+10));

The returned char will be '/' (ASCII code 47). You don't have to decode this manually, just replace eval() by echo() and you'll get the decoded script. Let's have a look at it. The new script is also obfuscated but it remains easy to read. At the very beginning of the script, you have got this line:

var g = ["HKCU","HKLM","HKCU\\vjw0rm","\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\","HKLM\\SOFTWARE\\Classes\\","REG_SZ","\\defaulticon\\"];

It's a sample of the vjw0rm worm that was discovered for the first time in 2018! [2]. If you want to have a look at the code, a version is available on GitHub.[3]

This worm has been used multiple times in miscellaneous campaigns and it seems to be still active today. The C2 server is hxxp://dhanaolaipallets[.]com:7974/. Note that, thanks to the new obfuscation technique, the VT score remains low!

[1] https://www.virustotal.com/gui/file/70c0b9d1c88f082bad6ae01fef653da6266d0693b24e08dcb04156a629dd6f81/detection/
[2] https://www.f-secure.com/v-descs/worm_js_vjw0rm.shtml
[3] https://gist.github.com/drole/c22fd13f524f2843c004ecabbce84bb5

Xavier Mertens (@xme)
Senior ISC Handler - Freelance Cyber Security Consultant
PGP Key